ILOVEYOU

ILOVEYOU
Email with an infected attachment
Malware details
Aliases	Love Bug, Loveletter
Type	Computer worm
Origin	Manila, Philippines
Author	Onel de Guzman
Technical details
Platforms	Windows 9x Windows NT 4.0 Windows 2000
Size	10.31 kilobytes
Written in	VBScript

ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected over ten million Windows personal computers beginning on 4 May 2000. It started spreading as an email message with the subject line "ILOVEYOU" and the attachment "LOVE-LETTER-FOR-YOU.TXT.vbs".^[1] Windows computers often hide the VBS file extension (a type of interpreted file) by default, because it is an extension for a file type that Windows knows, leading unwitting users to think it was a normal text file. Opening the attachment activated the VBScript script. First, the worm inflicted damage on the local machine, overwriting files (including image files; however, it hid MP3 files instead of deleting them). Then, it copied itself to all addresses in the Windows Address Book used by Microsoft Outlook, allowing it to spread faster than previous email worms.^[2]

Onel de Guzman,^[3] a 24-year-old computer science student at AMA Computer College^[4] and resident of Manila, Philippines, created the malware. Because there were no laws in the Philippines against making malware at the time of its creation, the Philippine Congress enacted Republic Act No. 8792, otherwise known as the E-Commerce Law, in July 2000 to discourage future iterations of such activity. However, the Constitution of the Philippines prohibits ex post facto laws, and as such, de Guzman could not be prosecuted.^[5]

The ILOVEYOU worm was coded by Onel de Guzman, a student at AMA Computer College in the Philippines. At the time of its creation, de Guzman was poor and struggling to pay for the country's dial-up internet access.^[4] De Guzman believed that internet access was a human right,^[4] and submitted an undergraduate thesis to the college which proposed the development of a trojan to steal internet login details.^[6] He reasoned that this would allow users to be able to afford an internet connection, arguing that those affected by it would experience no loss.^[4] The proposal was rejected by the college, which remarked that his proposal was "illegal" and that "they did not produce burglars".^[6] This led de Guzman to claim that his professors were closed-minded,^[3] ultimately dropping out of the college to begin developing the worm.^[7]

De Guzman wrote ILOVEYOU in VBScript, and the Windows Script Host is utilized to run the code. ILOVEYOU was distributed through malicious email attachments. The worm was found in emails with the subject "ILOVEYOU" and a message of "Kindly check the attached love letter from me." The attachment LOVE-LETTER-FOR-YOU.TXT.vbs contained the worm.^[8]

Upon opening the file, the worm copies itself into relevant directories so it will be run upon reboot of the computer. Two of the three copies masquerade as legitimate Microsoft Windows library files, named MSKernel32.vbs and Win32DLL.vbs. The other copy retains the original LOVE-LETTER-FOR-YOU.TXT.vbs name.^[9]

The worm attempts to download a trojan horse named WIN-BUGSFIX.exe. To achieve this, the victim's Internet Explorer homepage is set to a URL that downloads the trojan upon opening the browser. If the download is successful, the trojan is set to run upon reboot and the Internet Explorer homepage is set to a blank page. The trojan fulfils de Guzman's primary aim by stealing passwords.^[9]

The worm sends its trademark email to all contacts in the victim's address book. To prevent multiple emails being sent to one person from each successive run of the worm, a registry key is generated for each address book entry once an email has been sent. The worm will only send an email if the registry key is not present. This also allows for emails to be sent to new contacts placed in the address book. ILOVEYOU also has the capability to spread via Internet Relay Chat channels.^[9]

The worm searches connected drives for files to modify. All VBScript files it finds (.vbs, .vbe) are overwritten with the worm's code. Files with extensions .jpg, .jpeg, .js, .jse, .css, .wsh, .sct, and .hta are replaced with copies of the worm that have the same base file name but appended with the .vbs extension. Copies for .mp2 and .mp3 files are similarly produced, but the original files are hidden instead of removed.^[9]

ILOVEYOU is considered to be one of the first examples of malware using social engineering,^[10] since its email encouraged potential victims to open the infected attachment under the pretext they had a lover who was attempting to contact them.^[11] The worm's use of its previous victim's address book further incentivized recipients to comply, as emails appeared to come from close contacts.^[12] The worm's subsequent success has resulted in the use of social engineering in many modern-day malware attacks.^[10]

The attachment used a file name that took advantage of a feature of Microsoft Windows, "Hide extensions for known file types", where only the base file name would be displayed. As the file name was parsed from right to left, which would be stopped after the first period, to victims the attachment could appear to be an inconspicuous .txt file incapable of holding malware. The worm's real .vbs extension could be hidden.^[12] De Guzman also claimed that a bug in Windows 95, where code in email attachments was automatically run upon being clicked, contributed to the worm's success.^[4]

The use of VBScript in ILOVEYOU's coding allowed for easy modification to change the worm's behaviour. Over 25 variants of the ILOVEYOU worm have been recorded.^[13] Variants exhibited a variety of behaviours that differed from the original worm, such as changing which file extensions were affected, modifying the email subject (sometimes to target a specific audience) and changing the worm's author credit.^[13][14]

A notable variant of ILOVEYOU was NewLove, which was especially destructive since it targeted every file on the victim's hard drive until their computer stopped working^[15] and evaded antivirus software.^[15][16] Despite widespread coverage of this variant by media outlets, it failed to cause significant damage.^[16]

Originally designing the worm to only work in Manila, de Guzman removed this geographic restriction out of curiosity, which allowed the worm to spread worldwide. De Guzman did not expect this worldwide spread.^[4]

The worm originated in the Pandacan neighborhood of Manila in the Philippines on 4 May 2000,^[17] thereafter moving westward through corporate email systems as employees began their workday that Friday morning – moving first to Hong Kong, then to Europe, and finally the United States.^[18][19] Whole networks were compromised through a singular attachment access by any one user.^[20]

In the United Kingdom, the worm reached the email servers of the House of Commons on 4 May.^[6] The servers were shut down for two hours in response.^[18] The worm affected the banking system of Belgium.^[21]

The worm affected most federal government agencies and caused disruption to multiple, including the Department of Justice, the Department of Labor and the Social Security Administration.^[21] Operations of the Central Intelligence Agency^[18] and the Department of Defense were significantly obstructed,^[21] with the United States Army having 2,258 infected workstations that cost approximately US$79,200 to recover.^[22] The Veterans Health Administration received 7,000,000 ILOVEYOU emails during the outbreak, requiring 240 man-hours of work to resolve the problems created.^[21] Files at the National Aeronautics and Space Administration were damaged, and in some cases unrecoverable from backups.^[21]

Local internet service provider Sky Internet took down web pages delivering the WIN-BUGSFIX.exe trojan.^[23] Further investigations by ISPs linked the malware to a phone line associated with an apartment belonging to de Guzman's sister.^[24] De Guzman's mother warned him of the worm's public attention and his computer,^[4][25] but left behind floppy disks containing malware that unintentionally implicated other students from AMA Computer College.^[26] A police raid on 8 May 2000 led to the seizure of these disks and the arrest of De Guzman's sister's boyfriend.^[24] Authorities initially presented him as the main suspect for the creation of the worm and sought to find De Guzman's sister, however released him a day later because of insufficient evidence.^[27][28]

The Philippines' National Bureau of Investigation was unsure of what felonies could apply^[29] since there were no specific laws against hacking in the Philippines at the time.^[4] Ultimately, de Guzman was charged under the Access Device Regulation Act, a law designed mainly to penalize credit card fraud, and malicious mischief, a felony involving damage to property.^[30] All charges against De Guzman were later dropped by prosecutors, since the evidence collected did not support what had been filed.^[31][32]

De Guzman's last known public appearance was at a press conference on 11 May 2000, where he obscured his face and allowed his lawyer to answer most questions; his whereabouts remained mostly unknown afterward.^[4] In April 2019, investigative journalist Geoff White visited the Quinta Market in Manila to look for de Guzman, following a tip off from an internet forum.^[25] He discovered de Guzman working at a mobile phone repair stall in the market.^[26] De Guzman admitted to creating and releasing the worm, and cleared all others who had been accused of co-authoring it.^[4] White later published his findings in his cybercrime book, Crime Dot Com (2020).^[4]

ILOVEYOU has repeatedly been named as one of the most destructive and virulent pieces of malware in history.^[6][11][33] Within ten days of the first reported cases, over fifty million infections had been reported,^[34] and it is estimated that 10% of Internet-connected computers in the world were eventually affected.^[12] It is difficult to numerically quantify the damages caused by ILOVEYOU,^[20] however estimates in the 2020s place this figure between US$10^[6][35] to $15 billion.^[12] These primarily consisted of the time and effort spent removing infection and recovering files from backups.

To address legislative deficiencies against computer hacking, in July 2000 the Philippine Congress enacted Republic Act No. 8792 (also known as the E-Commerce Law).^[5][36] Since this law was passed after the worm's release, de Guzman could not be prosecuted retroactively under it.^[6][36] De Guzman's actions received mixed reactions - some believed he had evaded justice; others viewed him as a hero and he was offered (but ultimately turned down) jobs at computer companies.^[6][37]

The events inspired the song "E-mail" on the Pet Shop Boys' UK top-ten album of 2002, Release.^[38]

"I love you [rev.eng]" exhibited in July 2006 is a revamped and expanded version of an exhibition shown in June 2002 in the Museum for Applied Art in Frankfurt, in February 2003 at transmediale in Berlin, in August 2004 at the Watson Institute of the Brown University USA and in October 2004 at the Museum for Communication Copenhagen, Denmark.^[39] In 2009, Kiat Kiat Projects curated an email exhibition entitled "How to Prevent Hair Loss" inspired by ILOVEYOU.^[40][41]

The worm inspired the 2011 movie Subject: I Love You starring Jericho Rosales and Briana Evigan.^[42] In 2019, The Persistence of Chaos, a laptop infected with six viruses including ILOVEYOU was sold at auction by Chinese artist Guo O Dong.^[43] In November 2024, The Museum of Malware Art in Helsinki, Finland included a sculpture about ILOVEYOU.^[44]

• Computer virus
• Timeline of notable computer viruses and worms

• Radsoft: The ILOVEYOU Roundup Archived 22 June 2024 at the Wayback Machine
• "No 'sorry' from Love Bug author" at The Register
• CERT Advisory CA-2000-04 Love Letter Worm (archive)